The most recently released versions of the OverTone packages on NuGet receive security fixes.

Please do not open a public issue for security vulnerabilities.

Instead, report them privately through GitHub's private vulnerability reporting (the Security → Report a vulnerability button on the repository).

You can expect an initial response within a few days. Once a fix is available it will be released to NuGet and disclosed in the changelog.